Deployment Architecture

Are there any other reasons to have a search factor not equal to replication factor?

fredclown
Contributor

If space is not really an issue are there any other reasons to have the search factor lower that the replication factor? Thanks.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @fredclown,

no, the only reason is storage saving because indexes are the most part of storage occupation (row data iare around 15% of the original data and indexes are around 35% or the original data).

if you haven't storage occupation problems, you can use the same SF and RF.

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

This is really a border case but remember that indexes are built independently on each indexer so if you have SF=RF=8, you use CPU time for indexing on 8 indexers whereas if you have RF=8 but SF=2, you just stream the data to 6 indexers and store it and only on 2 indexers you prepare searchable indexed data for the bucket.

As I said, it's a border case since often the difference across your environment will be insignificant but there is a difference.

Also remember that only primary copy of the bucket participates in search so having a high SF lets you recover from disaster easier but doesn't speed up searches.

gcusello
SplunkTrust
SplunkTrust

Hi @fredclown,

no, the only reason is storage saving because indexes are the most part of storage occupation (row data iare around 15% of the original data and indexes are around 35% or the original data).

if you haven't storage occupation problems, you can use the same SF and RF.

Ciao.

Giuseppe

fredclown
Contributor

Thanks sir.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...